CN104597850A - Data exchange and synchronization method and data exchange and synchronization device for three-redundancy servo controller - Google Patents

Abstract

The invention belongs to the technical field of carrier rocket servo control, and particularly relates to a data exchange and synchronization method and a data exchange and synchronization device for a three-redundancy servo controller. The invention provides a data exchange and synchronization method and a data exchange and synchronization device for a three-redundancy servo controller, which are simple and effective, can realize the design of a multi-redundancy system under the condition of avoiding the introduction of complex redundant resources, and meet the demand of high-reliability aerospace application. The device comprises three sets of identical control driving paths which are sequentially connected by a communication network. Each set of control driving path comprises a processor, and a control power management module, an analog instruction and detection level signal interface, a 1553B communication control module, a communication SCLCAN, a three-redundancy potentiometer interface, a driving protection module, a three-phase bridge inverter module, a current detection module, and a speed sensor decoding module, which are communicated with the processor.

Description

Method and device for data interaction and synchronization of three redundant servo controllers

technical field

The invention belongs to the technical field of launch vehicle servo control, and in particular relates to a method and device for data interaction and synchronization of three redundant servo controllers.

Background technique

With the rapid growth of the international commercial launch market and the vigorous development of my country's aerospace industry, especially manned spaceflight puts forward more stringent requirements for launch reliability. A condition that is critical to satisfying a need.

As an important part of the whole arrow/bomb, the servo controller interacts with the data on the missile and analyzes the control instructions upward, and controls and drives the servo mechanism downward. Only by further improving its reliability can it meet the growing high-density launch support capability. need. Looking at some aerospace powers in the world, they mostly use redundancy strategies to improve system-level reliability, that is, when some functional modules fail, they can find and isolate the fault source through redundancy management, system reconstruction and other technologies to achieve system-level reliability. The function does not fail and the system operates reliably. In view of this, the research on redundant electromechanical servo control technology with deep fault tolerance has far-reaching practical significance and broad application prospects.

Fault-tolerant technology is to tolerate errors. It means that when one or more key parts of the equipment fail, by taking corresponding measures, it can maintain its specified functions, or ensure that the equipment continues to complete its basic functions safely under acceptable performance indicators.

Fault-tolerant control originated in the 1960s and was first used in the military field. In 1967, under the advocacy of NASA, ONZ, the US Naval Research Office, took the lead in conducting research on mechanical fault diagnosis and fault-tolerant control. In terms of aviation, Boeing 747, DC9 and other large-scale technological fault-tolerant systems can use a large amount of information in flight to analyze the faults of various parts of the aircraft and issue orders to eliminate faults, greatly improving flight safety.

An existing fault-tolerant technology is realized by adding cold backup hardware resources and fault detection and evaluation resources. The idea is to use fault detection and evaluation hardware resources to monitor the operating status of the main When a failure occurs, the failure detection and evaluation device will terminate its work output, and at the same time start the backup equipment to "take over" the work of the main equipment, so as to achieve the purpose of "failure/work/safety" in turn. There are two deficiencies in this method. First, there is a more or less time delay for backup resources from startup to stable work, and the switching process has certain instability; second, as a fault detection and evaluation device Reliability is a short board of the whole system, once it fails, the whole system will fail.

Different from cold backup, another existing fault-tolerant technology is to use the method of adding hot backup hardware resources to achieve fault tolerance. Both the primary and backup resources are in working state. When the detection device detects the failure of the primary device, it will switch to the backup device. . Although this method has improved the stability of switching to a certain extent, the shortcoming of the reliability of detection and evaluation resources is still unavoidable.

In addition, in the existing technology, there is also a technology of using multi-port RAM to realize data exchange between redundant resources. This method also needs to comprehensively manage the data written into RAM from different ports to ensure that there will be no wrong read and write operations on the same space by different processors.

To sum up, in order to improve the reliability of the system, it can be realized by upgrading components and adding backups. However, adding resources also has a certain failure rate. How to minimize the negative impact of adding resources on system reliability is a problem worthy of further study.

Contents of the invention

The purpose of the present invention is to provide a simple, effective, multi-redundant system design that can meet the needs of high-reliability aerospace applications while avoiding the introduction of more complex redundant resources. A method and device for data interaction and synchronization of three redundant servo controllers.

Technical scheme of the present invention is:

A device for data interaction and synchronization of three redundant servo controllers, including three identical sets of control drive paths, which are sequentially connected through a communication network.

Each set of control and drive paths includes a processor and a control power management module connected to the processor, an analog command and a detection level signal interface, a 1553B communication control module, a communication SCLCAN, a 3-degree potentiometer interface, and a drive protection module , three-phase bridge inverter module, current detection module and speed sensor decoding module; the three-phase bridge inverter module is connected to the motor, the speed sensor on the motor is connected to the speed sensor decoding module, and the 3-degree potentiometer on the motor is connected to the 3 The redundancy potentiometer interface is connected.

Each set of control drive channels has two HSSI peripheral interfaces, namely HSSIa and HSSIb. The six HSSI interfaces of the three sets of control drive channels form two communication links in opposite directions, one for clockwise transmission and one for counterclockwise transmission.

A method for data interaction and synchronization of three redundant servo controllers, comprising the following steps:

(4.1) After entering the timing interrupt, the 2CPU first reads the data received by the DMA;

(4.2) and time-calibrate and use the data according to the time-scale information;

(4.3) After executing steps such as servo calculation, the data is packaged at the end of the timer interrupt service program and sent by DMA.

The beneficial effects of the present invention are:

1. The three-redundancy servo controller is composed of three sub-controllers with isomorphic hardware resources. The three sub-controllers are connected in pairs, and the communication method adopts a full-duplex high-speed synchronous serial interface. In addition to adding three full-duplex communication channels and interface resources, no third-party evaluation hardware is introduced, which reduces the hidden danger of increasing failure points brought about by the introduction of components, and is conducive to improving system reliability.

2. The three control nodes have equal status in the system, and there is no distinction between active and standby. The three nodes control their own actuators respectively, and the subsequent stage fuses the output through mechanical means, and effectively improves the reliability of the system by utilizing the characteristics of higher reliability of the mechanical structure than the electrical system.

3. The data interaction strategy adopts the method of double data circulation to realize the deep sharing and interaction of data information of the three control nodes. The data interaction itself has a one-degree failure/working capability, which improves system reliability.

4. Use DMA (Direct Memory Access) technology to realize the transmission between data transmission channels, which can perform high-speed transmission of large data without occupying precious resources of the CPU. Therefore, under the premise of paying less resources, the bandwidth of data interaction between multiple control cores is greatly improved, and the real-time performance of data transmission is effectively improved.

5. The data synchronization between the three control nodes adopts the method of time stamp positioning, and adopts a relatively loose event-level synchronization method. While ensuring the response characteristics of the system, the synchronization design method is simplified, and the simple and effective algorithm effectively improves the reliability.

6. There are no specially designed hardware testing and evaluation resources, and pure software is used for data fusion and fault-tolerant control, which greatly improves system reliability

Description of drawings

Figure 1 is a block diagram of sub-controllers;

Fig. 2 is a communication platform topology diagram of a three-redundant fault-tolerant system;

Fig. 3 is a schematic diagram of an alternative path in the case of a single path failure;

Fig. 4 is a schematic diagram of parallel computing platform receiving and sending data;

Figure 5 is a flow chart of data sending and receiving.

Detailed ways

A method and device for data interaction and synchronization of three redundant servo controllers proposed by the present invention will be further introduced below in conjunction with the accompanying drawings and embodiments:

The triple-redundancy servo controller consists of three sets of identical control and drive paths (sub-controllers). The three sets of sub-controllers exchange data and communicate with each other through the communication network to form a parallel computing system. Each sub-controller includes functional modules such as processor, control power management, drive power management, analog/digital command input, potentiometer detection, current detection, inverter output and power protection. As shown in Figure 1, it is a block diagram of the sub-controller.

The three sub-controllers use high-speed communication interfaces to form a parallel computing platform that can realize data interaction, sharing and synchronization. As shown in Figure 2, the communication platform topology of the three-redundant fault-tolerant system, each control core has two HSSI (High-speed synchronous serial interface, high-speed synchronous serial interface) peripheral interfaces, called HSSIa and HSSIb respectively . The six HSSI interfaces of the three sub-controllers are connected in the manner shown in Figure 2 to form two communication links in opposite directions, one for clockwise transmission and one for counterclockwise transmission. That is, the information of any node in the structure can be transmitted to any other point through any link of these two links. This flexible communication structure undoubtedly increases the fault tolerance of the communication system. Even in the case of partial failure of the communication structure, the structure can still ensure the unobstructed flow of information to the greatest extent, and maximize the "work/failure" and "safety/failure" capabilities of the system. For example, when the communication link 1 in Figure 3 fails (marked by a dotted line), the data originally sent from the upper node to the left node will be sent via links 2 and 3. This relay method can tolerate the communication network itself. Faults, from a system point of view, have high reliability.

The triple-redundancy servo control system has three mutually independent CPUs. How to maintain synchronous calculation among the three processing cores is a key factor to evaluate the advantages and disadvantages of parallel computing algorithms and affect the effective work of the system. The present invention adopts the "event-level" synchronization method, does not pursue complete consistency on the clock, but realizes "synchronization" as much as possible in the processing of information data such as instructions and sensors, and aligns by calculating the time scale of the input data To ensure the "consistency" of the output.

In the servo calculation, the bandwidth of the current loop as the inner loop is 10kHz, so the calculation period of the inner loop is 100us. Fig. 4 is a schematic diagram of receiving and sending data by the parallel computing platform. Because it is impossible for the three CPUs to be powered on at the same time and run in an absolutely synchronous manner, a running time deviation as shown in Figure 4 will occur. In the figure, Tservo is the time slice required for servo calculation and drive control rate generation calculation, and Tother represents the remaining time slice resources of the 100us timing cycle after excluding the above time. In the figure, Tx1 represents the sending trigger signal sent by CPU1 to other CPUs in the network, and Tx2 and Tx3 are the same. Rx1.2 indicates the receiving trigger of the data stream sent by CPU1 on CPU2, and other expressions are similar. Generally speaking, the time difference between the sending trigger and the receiving trigger is fixed, but because the priority of the receiving trigger is lower than that of the system 100us timing interrupt, the function of receiving the trigger responds in the Other time slice, which results in the Situation, that is, the reception triggered by the same transmission source is triggered in two 100us interrupt time slices. But from a macro point of view, each Tother time slice will receive two reception triggers, but the two triggers are not the same beat data.

The present invention proposes an effective synchronization processing method, that is, it is considered that two receiving triggers in the same Tother time slice are "synchronized", then the servo control data will have an error of "one beat" (100us) at most. However, data such as current sensing are slow-changing data, and its bandwidth is lower than the sampling rate of 10kHz. This feature better absorbs the influence of "synchronization" caused by "one beat" error. In addition, the time scale information of the data is combined to filter the data, which can effectively improve data reliability while ensuring synchronization.

Figure 5 shows the flow chart of single-node data sending and receiving in the parallel computing platform. 1. After entering the timing interrupt, the 2CPU first reads the data received by the DMA, and time-calibrates the data according to the time stamp information and uses the . 3 Then, after executing steps such as servo calculation, the data is packaged at the end of the timer interrupt service program and sent by DMA. Utilizing this simple transceiver structure, the effective transmission and sharing of data among the three control nodes can be realized, and it has high reliability.

Claims (4)

1. for data interaction and the synchronous device of triple redundance servo controller, it is characterized in that: comprise the identical control of three covers and drive path, three covers are controlled to drive between path and connected by communication network successively.

2. a kind of data interaction for triple redundance servo controller and synchronous device as claimed in claim 1, is characterized in that: control power management module, dummy instruction that described often cover controls to drive path to comprise processor and be connected respectively at processor and detect level signal interface, 1553B communication control module, communication SCLCAN, 3 remaining pot interfaces, drive protection module, three-phase bridge inversion module, current detection module and speed pickup decoder module; Three-phase bridge inversion module is connected with motor, and the speed pickup on motor is connected with speed pickup decoder module, and 3 remaining pots on motor are connected with 3 remaining pot interfaces.

3. a kind of data interaction for triple redundance servo controller and synchronous device as claimed in claim 1, it is characterized in that: often cover controls to drive path to have two HSSI Peripheral Interfaces, be respectively HSSIa and HSSIb, three covers control to drive six hssi interfaces of path to form two contrary communication links of direction, a clockwise transmission, a counterclockwise transmission.

4. a kind of data interaction for triple redundance servo controller and synchronous method as claimed in claim 1, is characterized in that: comprise the following steps:

(4.1), after entering Interruption, first 2CPU reads the data received by DMA;

And according to time scale information carried out to data time calibration and use (4.2);

(4.3) after executing the steps such as servo calculating, at Interruption service routine last data packed and transfer to DMA to send.